MAC Address Formatter & Converter
Paste a MAC address in any notation and get colon, dash, Cisco-dot and bare forms back instantly, plus a bit-level read of what kind of address it is.
Formats
Address type
How to use this tool
- Paste a MAC address in whatever notation you have it in — colon-separated, dash-separated, Cisco dotted, or one unbroken string of 12 hex digits. Mixed case is fine.
- All four common formats appear at once, so you can copy whichever one the tool, config file or CLI you’re working with expects.
- Check the Address type panel to see whether the address is unicast or multicast, and universally or locally administered, read straight from the first octet’s bits.
- Use the example buttons to see a real unicast, multicast and locally-administered address side by side if you want a reference point.
A MAC address is 48 bits, almost always written as 12 hex digits, and the notation varies purely by convention between ecosystems: colon-separated (AA:BB:CC:DD:EE:FF) is the Unix/Linux and general networking default, dash-separated (AA-BB-CC-DD-EE-FF) shows up on Windows, and Cisco IOS uses four-character dot-separated groups in lowercase (aabb.ccdd.eeff). None of these encode different information — it is the same 48 bits, just grouped and punctuated differently — which is why converting between them is a pure text transform with no ambiguity, as long as the input actually has 12 valid hex digits.
The two bits that matter for classification both live in the first octet, and they are easy to remember once you know where to look. Bit 0 (the least significant bit of the first octet, as transmitted) is the individual/group (I/G) bit: 0 means the frame is addressed to a single device (unicast), 1 means it is addressed to a group (multicast, or the all-ones broadcast address as a special case). Bit 1 is the universal/local (U/L) bit: 0 means the address was assigned by the hardware vendor from an IEEE-registered OUI block and is globally unique; 1 means it was assigned locally — by software, a hypervisor, or an administrator — and IEEE makes no uniqueness guarantee about it.
Locally administered addresses are everywhere in modern virtualized and containerized infrastructure, and recognizing one on sight is a genuinely useful skill. A first octet of 02, 06, 0A or 0E (any value with bit 1 set and bit 0 clear) marks a locally-administered unicast address, and 02:xx:xx:xx:xx:xx in particular is such a common convention for virtual NICs — libvirt, Docker’s default bridge, various hypervisors — that seeing it is usually a strong hint you are looking at a VM, container, or virtual interface rather than physical hardware with a vendor-assigned address.
The multicast bit matters operationally too, not just for classification: switches handle multicast destination addresses differently from unicast ones for flooding and IGMP snooping purposes, and a handful of well-known multicast MAC ranges are worth recognizing directly. 01:00:5E:00:00:00 through 01:00:5E:7F:FF:FF is the range IPv4 multicast maps onto at layer 2 (the low 23 bits of the multicast IP go directly into the low 23 bits of the MAC). 33:33:xx:xx:xx:xx serves the same role for IPv6 multicast. And FF:FF:FF:FF:FF:FF, all bits set, is the Ethernet broadcast address — technically a multicast address by the bit-level definition, but reserved as a distinct special case that every device on the segment must accept.
Frequently asked questions
How can I tell if a MAC address is real hardware or a virtual NIC?
Check bit 1 of the first octet, the U/L bit. If it’s set (first octet ends in 2, 6, A or E in hex, such as 02:...), the address is locally administered — assigned by software rather than burned into hardware by a vendor. A first octet ending in 0, 4, 8 or C means a universally administered, vendor-assigned address, which is what you’d expect from real hardware.
What is the difference between unicast and multicast MAC addresses?
Bit 0 of the first octet, the I/G bit. Clear (0) means unicast, addressed to one device. Set (1) means multicast, addressed to a group of devices that have chosen to listen for it — the all-ones broadcast address is a special case of this, addressed to every device on the segment.
Why does my Cisco switch show MAC addresses as aabb.ccdd.eeff?
That’s Cisco IOS’s own notation: the same 12 hex digits as any other format, just grouped into three four-character blocks separated by dots, conventionally lowercase. It carries no different information from colon or dash notation — it’s purely a display convention specific to Cisco’s command-line output.
Are locally administered MAC addresses guaranteed to be unique?
Not by any external authority. IEEE guarantees uniqueness only for universally administered addresses assigned from a vendor’s registered OUI block. A locally administered address is only as unique as whatever assigned it makes it — usually fine within one hypervisor or one Docker host, but there is no global registry preventing two unrelated systems from picking the same one.
What does 01:00:5E in a MAC address mean?
It’s the fixed prefix IEEE reserves for mapping IPv4 multicast addresses onto Ethernet. The low-order 23 bits of the IPv4 multicast address are copied directly into the low-order 23 bits of the MAC, after this prefix and the multicast bit. Seeing this prefix is a reliable sign of IPv4 multicast traffic, such as IGMP-joined groups.